| 998 | } |
| 999 | |
| 1000 | AP_DECLARE(int) ap_check_request_header(request_rec *r) |
| 1001 | { |
| 1002 | core_server_config *conf; |
| 1003 | int strict_host_check; |
| 1004 | const char *expect; |
| 1005 | int access_status; |
| 1006 | |
| 1007 | conf = ap_get_core_module_config(r->server->module_config); |
| 1008 | |
| 1009 | /* update what we think the virtual host is based on the headers we've |
| 1010 | * now read. may update status. |
| 1011 | */ |
| 1012 | strict_host_check = (conf->strict_host_check == AP_CORE_CONFIG_ON); |
| 1013 | access_status = ap_update_vhost_from_headers_ex(r, strict_host_check); |
| 1014 | if (strict_host_check && access_status != HTTP_OK) { |
| 1015 | if (r->server == ap_server_conf) { |
| 1016 | ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10156) |
| 1017 | "Requested hostname '%s' did not match any ServerName/ServerAlias " |
| 1018 | "in the global server configuration ", r->hostname); |
| 1019 | } |
| 1020 | else { |
| 1021 | ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10157) |
| 1022 | "Requested hostname '%s' did not match any ServerName/ServerAlias " |
| 1023 | "in the matching virtual host (default vhost for " |
| 1024 | "current connection is %s:%u)", |
| 1025 | r->hostname, r->server->defn_name, r->server->defn_line_number); |
| 1026 | } |
| 1027 | r->status = access_status; |
| 1028 | } |
| 1029 | if (r->status != HTTP_OK) { |
| 1030 | return 0; |
| 1031 | } |
| 1032 | |
| 1033 | if ((!r->hostname && (r->proto_num >= HTTP_VERSION(1, 1))) |
| 1034 | || ((r->proto_num == HTTP_VERSION(1, 1)) |
| 1035 | && !apr_table_get(r->headers_in, "Host"))) { |
| 1036 | /* |
| 1037 | * Client sent us an HTTP/1.1 or later request without telling us the |
| 1038 | * hostname, either with a full URL or a Host: header. We therefore |
| 1039 | * need to (as per the 1.1 spec) send an error. As a special case, |
| 1040 | * HTTP/1.1 mentions twice (S9, S14.23) that a request MUST contain |
| 1041 | * a Host: header, and the server MUST respond with 400 if it doesn't. |
| 1042 | */ |
| 1043 | ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(00569) |
| 1044 | "client sent HTTP/1.1 request without hostname " |
| 1045 | "(see RFC2616 section 14.23): %s", r->uri); |
| 1046 | r->status = HTTP_BAD_REQUEST; |
| 1047 | return 0; |
| 1048 | } |
| 1049 | |
| 1050 | if (((expect = apr_table_get(r->headers_in, "Expect")) != NULL) |
| 1051 | && (expect[0] != '\0')) { |
| 1052 | /* |
| 1053 | * The Expect header field was added to HTTP/1.1 after RFC 2068 |
| 1054 | * as a means to signal when a 100 response is desired and, |
| 1055 | * unfortunately, to signal a poor man's mandatory extension that |
| 1056 | * the server must understand or return 417 Expectation Failed. |
| 1057 | */ |
no test coverage detected